PT-2026-44890 · Red Hat · Multicluster Engine For Kubernetes

Bzimport · Publicado 2026-05-29 · Atualizado 2026-05-29 · CVE-2026-10101

NVD

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

ACM/MCE assisted-service writes raw referenced pull-secret contents into InfraEnv.status.conditions[].message when pull-secret validation fails. A namespace principal with the stock view ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's .dockerconfigjson data from status.

This bypasses the Kubernetes/OpenShift RBAC separation between read-only namespace viewers and Secret readers. In the reproduced proof, the same ServiceAccount was denied get and list on Secrets, but recovered synthetic pull-secret username, password, email, and base64 auth fields through InfraEnv.status.

Correção

Enumeração de Fraquezas

CWE-201

Identificadores relacionados

CVE-2026-10101

Produtos afetados

Multicluster Engine For Kubernetes

Referências · 3

• https://bugzilla.redhat.com/show_bug.cgi?id=2483298 · Nota
• https://access.redhat.com/security/cve/CVE-2026-10101 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-10101 · Nota de Segurança